am: ffb5b3f9

Change-Id: I53aac064a2743064be1bff1087eeda445d3abbf9

am: a06236a0  -s ours

Change-Id: I78b6f59d35d5510f91bc3fb64818b13d50148850

am: 1a6fabea

Change-Id: I3b1a74f387cbf7388feb17f87f749964816df302

am: c4055f0d

Change-Id: I4f307d49476c1e84d8dd17d02f383d7c10a959fc

This is a partial revert of commit 82672089.
The previous commit removed a public type, which is a version-incompatible
change to the SELinux vendor API.  Since the 2017 devices are meant to be
launching with the previous version, this is unacceptable.  Revert the
version-incompatible parts of the change, but keep the other parts to enable
existing system functionality to persist and become part of MR1.  Leave TODOs
to remove the other parts when a version bump is acceptable.

Bug: 38241921
Test: Policy builds and device boots with ASAN enabled.
Change-Id: I0dd3673b8ed7fb86abd79cd04982396000e986f1

Specify per-service rules for PDX transport. Now being able to
grant permissions to individual services provided by processes,
not all services of a process.

Also tighter control over which permissions are required for
client and server for individual components of IPC (endpoints,
channels, etc).

Bug: 37646189
Change-Id: I78eb8ae8b6e08105666445a66bfcbd2f1d69d0ea
Merged-Id: I78eb8ae8b6e08105666445a66bfcbd2f1d69d0ea

am: 9639c5a8

Change-Id: Ia45f76ea09566cab4d36aa8f3a039ba4ebcf6f0c

am: 2dd9ae33

Change-Id: Ia17bae012b678ba604a4f869baf9b29027879ff5

am: 8465372b

Change-Id: I8bdc88c5984e4848d94b73f0bb3824f5a11fa981

am: 295a27a3

Change-Id: I8f3048b4e57a7970a3b31b2878d0dca522ab71de

am: 2c029ee1

Change-Id: I4ad2e5a08336f44ca8786be35e46ac7d705cb26f

am: 7469d816

Change-Id: Ie36c6266cc3387bba02974fb65614c75c8bd1425

am: fcfda81b

Change-Id: Iefe805a99749c29865b7f871cd4fc3fe11e1e536

am: 45c4b142

Change-Id: I6cb948d50f22f162d4b647259d12143cff7b61de

Sensord move in ag/2106763 should be accompanied by corresponding
sepolicy move of sensord-related files/declarations.

Bug: 36996994
Test: Sailfish build shows no related permission errors
Change-Id: Ibe41b363f7ca2752b5d3e0961298985cf784663d

This reverts commit 8c60f74d.

Bug: 38242876
Change-Id: Iba5a94d16901dc0c52f1941972c26877baa4805c

am: c1e8f825

Change-Id: I2db7693bb8bb77e396602caa37286090791a4689

am: 216b377d

Change-Id: I2ff6397f145424266cd1091e338323cff283397c

am: 14847b07

Change-Id: I2e467b433481631148ad5a761ebeff76459a4a54

am: 7e617640

Change-Id: Idefee5498a277bd5b507e648ff41bdc02aa0d752

am: d61c5dfa

Change-Id: I5dcc02f979a6cd1aa7d7b916425e8693860b8abc

Node for /dev/uhid driver needs to be accessible
by shell for the 'hid' command in frameworks/base/cmds.
This CL is in support of another CL c/2048848, topic
'Refactor hid command in /frameworks/base/cmds'
in internal master.

Bug: 34052337
Test: CTS test for GamepadTestCase#testButtonA; Checked that
cat /dev/uhid does not raise permission error.

Change-Id: I861c1226b4a67272af7c2a93d7811bf87a083478

am: 3799c82a

Change-Id: I484c27ed2aec6eff85420cb80c4d7fc9a3fc060b

am: 52711066

Change-Id: Ic937b16aebdfe046e425c98c0de0d0dfa4b5fc62

am: ce5ca4d0

Change-Id: I7f9cfa0a144ddfd796897446990f2b61108755c1

am: 1a3caeea

Change-Id: I6e26b4bc390bea7a3058aed7d0cf945feae6e8ed

am: d4eb49d1

Change-Id: I2b8c9b9d20cbec2a448ad60bc4abe7a52d8f7e46

Test: Build with ASAN on.
Bug: 36467375
Change-Id: Id6a07b7bd48f39326b7c7ab47cfde396f7cfd033

Specify per-service rules for PDX transport. Now being able to
grant permissions to individual services provided by processes,
not all services of a process.

Also tighter control over which permissions are required for
client and server for individual components of IPC (endpoints,
channels, etc).

Bug: 37646189
Change-Id: I78eb8ae8b6e08105666445a66bfcbd2f1d69d0ea

This is needed for devices using configfs, where init listens for
sys.usb.ffs.ready=1 to config usb_gadget. When recovery starts
sideloading, minadbd (forked from recovery) sets the property to trigger
that action.

avc:  denied  { set } for property=sys.usb.ffs.ready pid=541 uid=0 gid=0
scontext=u:r:recovery:s0 tcontext=u:object_r:ffs_prop:s0
tclass=property_service

Bug: 35803743
Test: Device shows up in sideload mode.
Change-Id: Ie7f1224d3a8650160ac29811f73b8286fbced4f4

configstore: assign label to all minor versions of configstore service am: c895f278 am: 8741d4fe am: 0e573bd5
am: 3986e935

Change-Id: I9f30605deb73d922d3758971a07a470f242b484a

configstore: assign label to all minor versions of configstore service am: c895f278 am: 8741d4fe
am: 0e573bd5

Change-Id: Ifde25dcde7b5eec4a797124ed3eeaa45dc9d4414

am: 8741d4fe

Change-Id: Iae383ed802d0e8a78d30ded05dbe3e0817b439e5